Windows 7 deprecation
Windows 7 will be removed from tria.ge on 2025-03-31
Analysis
-
max time kernel
148s -
max time network
152s -
platform
windows10-2004_x64 -
resource
win10v2004-20240802-en -
resource tags
arch:x64arch:x86image:win10v2004-20240802-enlocale:en-usos:windows10-2004-x64system -
submitted
12/08/2024, 05:07
Behavioral task
behavioral1
Sample
8d6ee5d168c4ebe39ef2816d0c789e84_JaffaCakes118.dll
Resource
win7-20240729-en
Behavioral task
behavioral2
Sample
8d6ee5d168c4ebe39ef2816d0c789e84_JaffaCakes118.dll
Resource
win10v2004-20240802-en
General
-
Target
8d6ee5d168c4ebe39ef2816d0c789e84_JaffaCakes118.dll
-
Size
166KB
-
MD5
8d6ee5d168c4ebe39ef2816d0c789e84
-
SHA1
d13143b8cc7d1e569202d7dfe01dc901b6517a28
-
SHA256
0e354b0a3dae3616280ca94e128efaa0dff8484848336651ae86766a92a3d6c3
-
SHA512
c812468e071bd86498273ec293d983d749eecb695bc38ba7a3af87f099bffafc71099078628276c57741c05a0c7bb4afa246db4e20f219e6cd68969b719e3a02
-
SSDEEP
3072:KgEvGJcoMSW6MFG1Yb3bdYTqaiZtjBG6o7+yT74Xff0DGzD74t0PCal:KgE+Js6ZidHTjg7+yAXj3uHO
Malware Config
Signatures
-
Adds autorun key to be loaded by Explorer.exe on startup 2 TTPs 1 IoCs
description ioc Process Set value (str) \REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Windows\CurrentVersion\ShellServiceObjectDelayLoad\DCOM Server 25319 = "{2C1CD3D7-86AC-4068-93BC-A02304B25319}" rundll32.exe -
Blocklisted process makes network request 4 IoCs
flow pid Process 3 552 rundll32.exe 7 552 rundll32.exe 69 552 rundll32.exe 70 552 rundll32.exe -
Drops file in Drivers directory 1 IoCs
description ioc Process File opened for modification C:\Windows\system32\drivers\etc\hosts rundll32.exe -
resource yara_rule behavioral2/memory/552-1-0x0000000001F70000-0x0000000002C9F000-memory.dmp upx behavioral2/memory/552-2-0x0000000001F70000-0x0000000002C9F000-memory.dmp upx behavioral2/memory/552-4-0x0000000001F70000-0x0000000002C9F000-memory.dmp upx behavioral2/memory/552-6-0x0000000001F70000-0x0000000002C9F000-memory.dmp upx behavioral2/memory/552-12-0x0000000001F70000-0x0000000002C9F000-memory.dmp upx behavioral2/memory/552-16-0x0000000001F70000-0x0000000002C9F000-memory.dmp upx behavioral2/memory/552-17-0x0000000001F70000-0x0000000002C9F000-memory.dmp upx -
System Location Discovery: System Language Discovery 1 TTPs 1 IoCs
Attempt gather information about the system language of a victim in order to infer the geographical location of that host.
description ioc Process Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language rundll32.exe -
Modifies data under HKEY_USERS 1 IoCs
description ioc Process Set value (str) \REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\26\52C64B7E\@%SystemRoot%\system32\hnetcfgclient.dll,-201 = "HNetCfg Client" svchost.exe -
Modifies registry class 6 IoCs
description ioc Process Key created \REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID rundll32.exe Key created \REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{2C1CD3D7-86AC-4068-93BC-A02304B25319} rundll32.exe Set value (str) \REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{2C1CD3D7-86AC-4068-93BC-A02304B25319}\InProcServer32\ = "C:\\Users\\Admin\\AppData\\Local\\Temp\\8d6ee5d168c4ebe39ef2816d0c789e84_JaffaCakes118.dll" rundll32.exe Set value (str) \REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{2C1CD3D7-86AC-4068-93BC-A02304B25319}\InProcServer32\ThreadingModel = "Apartment" rundll32.exe Key created \REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{2C1CD3D7-86AC-4068-93BC-A02304B25319}\InProcServer32 rundll32.exe Key created \REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node rundll32.exe -
Suspicious use of WriteProcessMemory 3 IoCs
description pid Process procid_target PID 2224 wrote to memory of 552 2224 rundll32.exe 84 PID 2224 wrote to memory of 552 2224 rundll32.exe 84 PID 2224 wrote to memory of 552 2224 rundll32.exe 84
Processes
-
C:\Windows\system32\rundll32.exerundll32.exe C:\Users\Admin\AppData\Local\Temp\8d6ee5d168c4ebe39ef2816d0c789e84_JaffaCakes118.dll,#11⤵
- Suspicious use of WriteProcessMemory
PID:2224 -
C:\Windows\SysWOW64\rundll32.exerundll32.exe C:\Users\Admin\AppData\Local\Temp\8d6ee5d168c4ebe39ef2816d0c789e84_JaffaCakes118.dll,#12⤵
- Adds autorun key to be loaded by Explorer.exe on startup
- Blocklisted process makes network request
- Drops file in Drivers directory
- System Location Discovery: System Language Discovery
- Modifies registry class
PID:552
-
-
C:\Windows\System32\svchost.exeC:\Windows\System32\svchost.exe -k LocalSystemNetworkRestricted -p -s Netman1⤵
- Modifies data under HKEY_USERS
PID:2464